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Good afternoon, and thank you for allowing nne to nnake brief connnnents on the 
California Consunner Privacy Act (CCPA) and its innpact on the digital advertising industry, 
specifically the advertising agency connnnunity. My nanne is Alison Pepper, and I ann the Senior 
Vice President of Governnnent Relations at the Annerican Association of Advertising Agencies 
(4A's). 


Founded in 1917, the 4A's is a trade association representing advertising agencies 
across the country. The 4A's helps empower our members to deliver insightful creativity that 
drives commerce and influences culture all while moving the industry forward. We are 
dedicated to, and vested in, our members' success, just as they are dedicated to helping 
brands create, distribute, and measure effective and insightful advertising and marketing. 
Today the 4A's serves 700+ member agencies across 1,300 offices, which control more than 
85% of total U.S. advertising spend. Currently, the 4A's has 213 member agencies based in 
California, representing approximately 30% of all 4A's members. 

The 4A's supports the goals of the CCPA, and understands the need for providing 
California consumers with more transparency in an increasingly complex online environment. 
As a founding supporter of the Digital Advertising Alliance (DTkA) back in 2008, an 
organization dedicated to providing consumers with more transparency about digital 
advertising, the 4A's has an established track record in working to ensure that consumers 
have access and choices when it comes to how their information is used online. 

While supporting and recognizing the overarching goal of the CCPA, we do have some 
concerns with the CCPA as passed. The CCPA appears to have some ambiguous language 
that leaves many agencies unclear as to not only what is required of them, but also presents 
questions as to the future of loyalty programs and other consumer-centric programs designed 
and promoted by our members. Collectively, these issues may not only undermine access to 
popular consumer programs, but more importantly, they could limit the effectiveness of 
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certain consunner protections. Specifically, sonne of the concerns raised by the CCPA include 
the following: 

1. Explicit Notice. Section 1798.115 (d) prohibits a third party fronn selling consunner 
personal information that has been sold to the third party by a business unless the 
consumer has received explicit notice and is provided an opportunity to opt out 
from the business selling the data. When a consumer chooses not to exercise this 
right, it's currently unclear that a third party can rely on a written assurance of CCPA 
compliance from the transferring party. It would be helpful to have clarity that 
recognizes that a written assurance of CCPA compliance is sufficient and 
reasonable. 

2. Publicly Available Data. Section 1798.140 (o)(2) states that personal information 
does not include publicly available information. However, this section also states 
that information is not publicly available if that data is used for a purpose that is not 
compatible with the purpose for which the data is maintained and made available in 
the government records for which it is publicly maintained. 

Many California public agencies already have rules and regulations around 
commercial use of public records. Certain public records can be used for important 
reasons from fraud prevention to auto vehicle recalls. CCPA appears to introduce 
new uncertainties into this process by potentially creating a new category of 
personal information when public records are used by commercial entities outside 
of the "purpose for which the data is maintained and made available." It's unclear if 
this new determination of acceptable scope of usage would be determined by the 
public agency providing the records, the CCPA, or some other entity. We would ask 
that some guidance be given to companies so that they can obtain a clear 
understanding as to what constitutes "in-scope" usage before proceeding. 


3. Treating Pseudonymized Data And Personal Information The Same. Section 

1798.140(o)(1)'s definition of "personal information," in combination with Section 
1798.140(g)'s definition of "consumer," suggests that the law will treat 
pseudonymized data in the same manner as data that could directly identify an 
individual. Pseudonymized data does not include data types that individually 
identify a person. Pseudonymized data is rendered in such a way that it does not 
address a specific consumer without additional information. Agencies are 
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concerned that these definitions would require thenn to try to associate non- 
identifiable pseudonynnized device data with a specific person seeking to exercise 
their CCPA rights, thus having the potentially unintended consequence of forcing 
agencies to take what was previously non-identifiable data and associate it with a 
specific person. Such a result would undernnine consunner privacy and rennove 
privacy protections fronn consunners. 

Thank you for the opportunity to speak today. We appreciate the California Attorney 
General's office willingness to listen to concerns associated with the CCPA, and the 4A's looks 
forward to subnnitting detailed written connnnents and working with you to develop 
innplennenting regulations for this innportant legislation. 



